ScreenShot
| Created | 2024.08.19 14:03 | Machine | s1_win7_x6401 |
| Filename | track523.exe | ||
| Type | PE32+ executable (GUI) x86-64, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 15 detected (AIDetectMalware, malicious, moderate confidence, score, Unsafe, Attribute, HighConfidence, Static AI, Suspicious PE, confidence) | ||
| md5 | 126d07c834b159e2057a4e431073f948 | ||
| sha256 | c1e856c165b29b0f49a55dfd451a817a0a5ee005faf812e818cc258a8a4013da | ||
| ssdeep | 3072:x/uExbUYX5Ey0QJvQv3wTn58bb2kE9x+O5S+LX51eLl7I+eXf/:xtdEy0QVQv3wD58bA9x+O5S+Vb+Sf/ | ||
| imphash | c60fadb080b3d036144e1f522684f1b1 | ||
| impfuzzy | 48:Z9S1YtSsBc+pyYZJ3vFSY/goCKX0WnB/KAlJVZS9:Z9S1YtSsBc+pyYpKahjc | ||
Network IP location
Signature (6cnts)
| Level | Description |
|---|---|
| watch | File has been identified by 15 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Creates executable files on the filesystem |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (7cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| warning | Generic_Malware_Zero | Generic Malware | binaries (upload) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Network_Downloader | File Downloader | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE64 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x14002d028 LoadLibraryW
0x14002d030 WriteConsoleW
0x14002d038 CreateFileW
0x14002d040 CloseHandle
0x14002d048 GetConsoleMode
0x14002d050 GetProcAddress
0x14002d058 FlushFileBuffers
0x14002d060 HeapReAlloc
0x14002d068 HeapSize
0x14002d070 SetFilePointerEx
0x14002d078 GetProcessHeap
0x14002d080 GetStringTypeW
0x14002d088 FreeLibrary
0x14002d090 VirtualProtect
0x14002d098 CreateProcessA
0x14002d0a0 GetConsoleOutputCP
0x14002d0a8 Sleep
0x14002d0b0 SetStdHandle
0x14002d0b8 FreeEnvironmentStringsW
0x14002d0c0 GetEnvironmentStringsW
0x14002d0c8 WideCharToMultiByte
0x14002d0d0 QueryPerformanceCounter
0x14002d0d8 GetCurrentProcessId
0x14002d0e0 GetCurrentThreadId
0x14002d0e8 GetSystemTimeAsFileTime
0x14002d0f0 InitializeSListHead
0x14002d0f8 RtlCaptureContext
0x14002d100 RtlLookupFunctionEntry
0x14002d108 RtlVirtualUnwind
0x14002d110 IsDebuggerPresent
0x14002d118 UnhandledExceptionFilter
0x14002d120 SetUnhandledExceptionFilter
0x14002d128 GetStartupInfoW
0x14002d130 IsProcessorFeaturePresent
0x14002d138 GetModuleHandleW
0x14002d140 RtlUnwindEx
0x14002d148 GetLastError
0x14002d150 SetLastError
0x14002d158 EncodePointer
0x14002d160 RaiseException
0x14002d168 EnterCriticalSection
0x14002d170 LeaveCriticalSection
0x14002d178 DeleteCriticalSection
0x14002d180 InitializeCriticalSectionAndSpinCount
0x14002d188 TlsAlloc
0x14002d190 TlsGetValue
0x14002d198 TlsSetValue
0x14002d1a0 TlsFree
0x14002d1a8 LoadLibraryExW
0x14002d1b0 RtlPcToFileHeader
0x14002d1b8 GetStdHandle
0x14002d1c0 WriteFile
0x14002d1c8 GetModuleFileNameW
0x14002d1d0 GetCurrentProcess
0x14002d1d8 ExitProcess
0x14002d1e0 TerminateProcess
0x14002d1e8 GetModuleHandleExW
0x14002d1f0 HeapFree
0x14002d1f8 HeapAlloc
0x14002d200 GetFileType
0x14002d208 FlsAlloc
0x14002d210 FlsGetValue
0x14002d218 FlsSetValue
0x14002d220 FlsFree
0x14002d228 LCMapStringW
0x14002d230 FindClose
0x14002d238 FindFirstFileExW
0x14002d240 FindNextFileW
0x14002d248 IsValidCodePage
0x14002d250 GetACP
0x14002d258 GetOEMCP
0x14002d260 GetCPInfo
0x14002d268 GetCommandLineA
0x14002d270 GetCommandLineW
0x14002d278 MultiByteToWideChar
USER32.dll
0x14002d2a0 GetMessageW
0x14002d2a8 LoadIconW
0x14002d2b0 MessageBoxW
0x14002d2b8 GetClientRect
0x14002d2c0 UpdateWindow
0x14002d2c8 ShowWindow
0x14002d2d0 CreateWindowExW
0x14002d2d8 RegisterClassW
0x14002d2e0 PostQuitMessage
0x14002d2e8 DefWindowProcW
0x14002d2f0 SendMessageW
0x14002d2f8 DispatchMessageW
0x14002d300 TranslateMessage
GDI32.dll
0x14002d000 SetBkColor
0x14002d008 CreateSolidBrush
0x14002d010 CreateFontW
0x14002d018 SetTextColor
SHELL32.dll
0x14002d288 SHGetFolderPathW
0x14002d290 ShellExecuteW
urlmon.dll
0x14002d310 URLDownloadToFileW
EAT(Export Address Table) is none
KERNEL32.dll
0x14002d028 LoadLibraryW
0x14002d030 WriteConsoleW
0x14002d038 CreateFileW
0x14002d040 CloseHandle
0x14002d048 GetConsoleMode
0x14002d050 GetProcAddress
0x14002d058 FlushFileBuffers
0x14002d060 HeapReAlloc
0x14002d068 HeapSize
0x14002d070 SetFilePointerEx
0x14002d078 GetProcessHeap
0x14002d080 GetStringTypeW
0x14002d088 FreeLibrary
0x14002d090 VirtualProtect
0x14002d098 CreateProcessA
0x14002d0a0 GetConsoleOutputCP
0x14002d0a8 Sleep
0x14002d0b0 SetStdHandle
0x14002d0b8 FreeEnvironmentStringsW
0x14002d0c0 GetEnvironmentStringsW
0x14002d0c8 WideCharToMultiByte
0x14002d0d0 QueryPerformanceCounter
0x14002d0d8 GetCurrentProcessId
0x14002d0e0 GetCurrentThreadId
0x14002d0e8 GetSystemTimeAsFileTime
0x14002d0f0 InitializeSListHead
0x14002d0f8 RtlCaptureContext
0x14002d100 RtlLookupFunctionEntry
0x14002d108 RtlVirtualUnwind
0x14002d110 IsDebuggerPresent
0x14002d118 UnhandledExceptionFilter
0x14002d120 SetUnhandledExceptionFilter
0x14002d128 GetStartupInfoW
0x14002d130 IsProcessorFeaturePresent
0x14002d138 GetModuleHandleW
0x14002d140 RtlUnwindEx
0x14002d148 GetLastError
0x14002d150 SetLastError
0x14002d158 EncodePointer
0x14002d160 RaiseException
0x14002d168 EnterCriticalSection
0x14002d170 LeaveCriticalSection
0x14002d178 DeleteCriticalSection
0x14002d180 InitializeCriticalSectionAndSpinCount
0x14002d188 TlsAlloc
0x14002d190 TlsGetValue
0x14002d198 TlsSetValue
0x14002d1a0 TlsFree
0x14002d1a8 LoadLibraryExW
0x14002d1b0 RtlPcToFileHeader
0x14002d1b8 GetStdHandle
0x14002d1c0 WriteFile
0x14002d1c8 GetModuleFileNameW
0x14002d1d0 GetCurrentProcess
0x14002d1d8 ExitProcess
0x14002d1e0 TerminateProcess
0x14002d1e8 GetModuleHandleExW
0x14002d1f0 HeapFree
0x14002d1f8 HeapAlloc
0x14002d200 GetFileType
0x14002d208 FlsAlloc
0x14002d210 FlsGetValue
0x14002d218 FlsSetValue
0x14002d220 FlsFree
0x14002d228 LCMapStringW
0x14002d230 FindClose
0x14002d238 FindFirstFileExW
0x14002d240 FindNextFileW
0x14002d248 IsValidCodePage
0x14002d250 GetACP
0x14002d258 GetOEMCP
0x14002d260 GetCPInfo
0x14002d268 GetCommandLineA
0x14002d270 GetCommandLineW
0x14002d278 MultiByteToWideChar
USER32.dll
0x14002d2a0 GetMessageW
0x14002d2a8 LoadIconW
0x14002d2b0 MessageBoxW
0x14002d2b8 GetClientRect
0x14002d2c0 UpdateWindow
0x14002d2c8 ShowWindow
0x14002d2d0 CreateWindowExW
0x14002d2d8 RegisterClassW
0x14002d2e0 PostQuitMessage
0x14002d2e8 DefWindowProcW
0x14002d2f0 SendMessageW
0x14002d2f8 DispatchMessageW
0x14002d300 TranslateMessage
GDI32.dll
0x14002d000 SetBkColor
0x14002d008 CreateSolidBrush
0x14002d010 CreateFontW
0x14002d018 SetTextColor
SHELL32.dll
0x14002d288 SHGetFolderPathW
0x14002d290 ShellExecuteW
urlmon.dll
0x14002d310 URLDownloadToFileW
EAT(Export Address Table) is none